Virtualization-enabled satellite platforms

ABSTRACT

Systems, methods, and software described herein provide enhancements for deploying applications in satellite systems. In one example, a satellite system comprises a communication interface configured to receive software payloads, and a satellite control system configured to operate logistical control elements of the satellite system. The satellite system further comprises a virtualized execution system configured to execute ones of the software payloads deployed on the satellite system as associated virtual nodes that share resources of the satellite system.

RELATED APPLICATIONS

This patent application is a continuation of, and claims priority to,U.S. patent application Ser. No. 15/297,436 that was filed on Oct. 19,2016, and is entitled “VIRTUALIZATION-ENABLED SATELLITE PLATFORMS,”which is hereby incorporated by reference into this patent application.

BACKGROUND

Satellites can be deployed into orbit to provide various space-basedoperations, such as military and civilian observation operations,communications operations, navigation operations, weather operations,and research operations. Satellites can include various sensors andcommunication equipment that are used to perform desired tasks. Forexample, a weather satellite may include one or more cameras or imagingsensors that can be used to take images of Earth, and communicationequipment that can be used to communicate the images to a control systemon Earth. Although satellites can be configured to perform thesespecialized operations, satellites are expensive to create and launchinto orbit, especially for organizations that may not require the use ofan entire satellite with a large number of sensors, or may not requirecontinuous operations on the satellite. As a result, organizations mayavoid the use of satellites, limiting the use of promising satellitetechnology.

OVERVIEW

The technology disclosed herein provides enhancements for deployingapplications to orbiting satellites. Systems, methods, and softwaredescribed herein provide enhancements for deploying applications insatellite systems. In one example, a satellite system comprises acommunication interface configured to receive software payloads, and asatellite control system configured to operate logistical controlelements of the satellite system. The satellite system further comprisesa virtualized execution system configured to execute ones of thesoftware payloads deployed on the satellite system as associated virtualnodes that share resources of the satellite system.

This Overview is provided to introduce a selection of concepts in asimplified form that are further described below in the TechnicalDisclosure. It should be understood that this Overview is not intendedto identify key features or essential features of the claimed subjectmatter, nor should it be used to limit the scope of the claimed subjectmatter.

BRIEF DESCRIPTION OF THE DRAWINGS

Many aspects of the disclosure can be better understood with referenceto the following drawings. While several implementations are describedin connection with these drawings, the disclosure is not limited to theimplementations disclosed herein. On the contrary, the intent is tocover all alternatives, modifications, and equivalents.

FIG. 1 illustrates a satellite environment according to animplementation.

FIG. 2 illustrates an expanded view of a satellite capable of providinga platform for virtual nodes according to an implementation.

FIG. 3 illustrates an operation of deploying satellites capable ofproviding a platform for virtual nodes according to an implementation.

FIG. 4 illustrates an operation of deploying virtual applications in asatellite according to an implementation.

FIG. 5 illustrates a satellite system capable of providing stateinformation between satellites according to an implementation.

FIG. 6 illustrates a timing diagram of overcoming a failure of asatellite in a satellite cluster according to an implementation.

FIG. 7 illustrates an operation for overcoming a failure of at least oneapplication node on a satellite according to an implementation.

FIG. 8 illustrates an operational scenario of providing stateinformation between satellites according to an implementation.

FIG. 9 illustrates an operational scenario of generating a new peer inresponse to a satellite failure according to an implementation.

FIG. 10 illustrates a timing diagram of overcoming a failure of asatellite in a satellite system according to an implementation.

FIG. 11 illustrates a satellite operation according to animplementation.

FIG. 12 illustrates a deployment user interface according to animplementation.

FIG. 13 illustrates a satellite computing system to provide avirtualized satellite application platform according to animplementation.

FIG. 14 illustrates a development computing system to generate virtualsatellite applications according to an implementation.

DETAILED DESCRIPTION

The various examples disclosed herein provide enhancements for satellitehardware and software technology. In particular, the examples disclosedherein provide systems and methods for deploying software applicationsto an orbiting satellite platform, wherein each of the softwareapplications executes as a virtual node that can share resources withone or more other applications deployed to the same satellite. Thesevirtual nodes may comprise full operating system virtual machines insome examples, and may further include virtual containers. Thesecontainers may include Docker containers, Linux containers, jails, oranother similar type of virtual containment node, which can provide anefficient management of resources from a host system. The resources usedby the containers may include kernel resources from the host computingsystem, and may further include repositories and other approvedresources that can be shared with other containers or processesexecuting on the host. However, although resources may be shared betweenthe containers on a host satellite, the containers are provisioned tohave private access to the operating system with their own identifierspace, file system structure, and network interfaces.

In the present example, to provide the satellite platform, a pluralityof satellites may be deployed, wherein organizations may generateapplications and deploy the applications to the satellites to performdesired operations. These operations may include military and civilianobservation operations, communications operations, navigationoperations, weather operations, and research operations. To develop theapplications, a development platform may be provided that permits theorganizations to develop software applications using a development tool.Once developed using the tool, the applications may be executed in avirtual or physical test environment replicating the physical satelliteplatform. This test environment may permit the user to upload thesoftware application to one or more test satellites and monitor theoperation of the application prior to deploying the application to thephysical satellite cluster. In some implementations, in developing theapplication, the provided development tool may include an applicationprogramming interface (API) or some other command structure, whichpermits the applications to request and access the various sensors andinterfaces provided by the physical satellite. Accordingly, althougheach of the software applications may perform different operations, theymay interact with sensors, such as cameras, antennas, and the like usingsimilar commands.

Once an application is developed using the development tool and the testenvironment, the application may then be deployed in one or moresatellites of the orbiting satellite platform. In some implementations,the application may be provided to each of the one or more satellitesusing a ground control system as an uplink to the one or moresatellites. In other implementations, a single uplink may be made to asatellite in the platform, wherein the satellite is configured todistribute the application to other desired satellites in the platform.Once deployed in the environment, the application may execute on theassigned satellites.

In some implementations, to manage the execution of the applications oneach of the satellites, a schedule may be generated, wherein theschedule may be responsible for scheduling the processing of each of theapplications, as well as the access for each of the applications to theuser sensors. For example, a first application on a satellite mayrequire access to an imaging sensor during a first time period, while asecond application may require access to the same sensor during a secondtime period. The schedule provided to the satellite may be used todetermine and allocate addressing links between each of the applicationsto the sensor based on the defined time periods. In at least oneimplementation, more than one applications may be allocated to the samesensor at any one time. This may permit applications providing differentoperations to receive the same data, but provide different functionalityin relation to the data. In other implementations, a single applicationmay prefer that no other applications receive are access the sensor atthe same time. Thus, the schedule may ensure that only a singleapplication is allocated or capable of communicating with the sensorduring the defined time period.

In some implementations, the satellites of the satellite platform mayeach exchange state information with one or more other satellites andthe ground control system for the platform. This state information mayinclude current operational state information for each of theapplications, such as the tasks or processes that are operating, and mayfurther exchange data generated at least partially from the sensors ofthe satellite. This data may be used in a peer group, wherein a firstsatellite may identify a first set of data, and provide the data to asecond satellite. The second satellite may then identify second dataand, process the first and second data as defined by the application.This operation may be used, as an example, in imaging operations,wherein a first satellite may take images of an object over a firstperiod of time, and provide data for the images to the second satellite.The second satellite may take subsequent images and use the data for thefirst images and the subsequent images to make a determination about anobject. Although this is one example, it should be understood that otheroperations may use peer sharing of state data to identifycharacteristics about measured data from the satellite sensors.

FIG. 1 illustrates a satellite environment 100 according to animplementation. Satellite environment 100 includes satellites 110-113,satellites 120-123, Earth 190, ground control system 170, and launchsystem 180. Satellites 110 and 120 belong to a first peer group 140, andsatellites 111, 112, and 122 belong to second peer group 141, whereinthe peer groups may be used to share state information, such asapplication state and data for the applications executing thereon.Satellites 110-113 and satellites 120-123 communicate via wirelesscommunication links 130-132. Ground control system 170 communicates withsatellites 110-113 and satellites 120-123 using wireless communicationlink 135.

As described herein, a plurality of satellites 110-113 and 120-123 maybe launched and deployed as an orbiting platform for a plurality ofdifferent software applications. To generate the applications, designplatform 175 is provided, which may include various tools and APIs thatpermit organizations to generate the software applications. In someimplementations, design platform 175 may provide users with selectablefunctions and interface elements that are available on each of thesatellites. Using the functions and available interface elements, thedeveloper or developers for a particular organization may generate asoftware application that performs desired operations. For example, adeveloper may generate an application that uses a camera on a satelliteto track movements of relevant objects.

Once the application is developed, the application may be provided toverification platform 176, which can be used to verify and test theapplication before deploying the application to the satellite platform.Verification platform 176 may comprise a physical or virtual testbed,wherein the application can be deployed to one or more test satellitesto determine the functionality of the application. In someimplementations, in addition to testing the functionality, verificationplatform may further apply tests to the application to ensure that theapplication is approved for operating on the physical platform. Thesetests may include, but are not limited to, ensuring the application isnot malicious to other applications that may execute on the samesatellite, ensuring the application does not change the flight structureor operations of the satellite, ensuring the data is properlycommunicated between other satellites and the ground control system, orany other similar tests to verify the operation of the application.

After the application is verified, orchestration platform 177 may beused as part of ground control system 170 to schedule the application inthe orbiting cluster. This scheduling may be used to identify which ofthe satellites apply to the generated applications, the processingresources that can be allocated to application, any securityrequirements for the application when being deployed with otherapplications, or some other similar scheduling requirement. Once therequirements are defined, a schedule may be determined based on therequirements, wherein the schedule may allocate one or more satellitesfor the operation of the application, as well as a processing scheduleon the satellite. For example, the application may only requireoperation on one side of Earth 190. Consequently, orchestration platform177 may generate a schedule that permits processing for the applicationwhen the satellite is geographically located on a specific side of Earth190.

Although the examples provided above include one version of generating aschedule, it should be understood that other information may be used indetermining the schedule of operation for the application. For example,the developer of an application may supply a cost constraint, whichcould be used in allocating the processing resources and user sensors onthe satellite. In other implementations, the developer may providerequirements, such as sensor security, and processing requirements, andbe provided with a list of available satellites that provide therequired criteria. From the list, the developer may then select the timeand satellites that are desired, and approve the application fordeployment to the satellite platform.

Once an application has been approved to be deployed to the satellitesof the satellite platform, ground control system 170 may initiate anuplink with one or more of the satellites to provide the application tothe satellites, as well as update any scheduling information for thesatellites. Once uploaded to the desired satellites, the application maybegin execution based on the scheduling determined at orchestrationplatform 177. In some implementations, the uplink from ground controlsystem 170 may be solely responsible for providing the applications tothe required satellites. In other implementations, ground control system170 may supply an application to a first set of satellites, which maythen distribute the application to one or more other satellites of thesatellite platform. For example, ground control system 170 may provide afirst application to satellite 120, wherein satellite 120 may, in turnsupply the application to other satellites in a peer group. Inparticular, satellite 120 may provide the application to satellite 110that is in the same peer group, permitting satellite 110 to provideoperations of the application without directly receiving thecommunication from ground control system 170. Additionally, similar toproviding the initial configuration to the satellites, ground controlsystem 170 may further be used to supply updates to each of theapplications operating in the satellite platform, and may further updateany scheduling information on each of the satellites.

Also illustrated in satellite environment 100 is launch system 180,which may be used to transport satellites (sats) 181 into orbit withorbiting satellites 110-113 and 120-123. Satellites 181 include ahardware and software configuration that permits applications to executeas virtual nodes on the satellites. In some implementations, satellites181 may be launched using launch system 180 without applications, andinstead may be provided with a base operating system or hypervisor thatcan be used to load and execute applications as they are provided in anuplink from ground control system 170. In other implementations,satellites 181 may be configured with a first set of applicationscapable of being executed via an operating system or hypervisor on thesatellites. Thus, once into orbit, the applications may initiateexecution to provide the operations of the applications. Theseapplications may further be added to, removed, and modified based oninformation provided in the uplink from ground control system 170.

FIG. 2 illustrates an expanded view 200 of a satellite 110 capable ofproviding a platform for virtual nodes according to an implementation.Satellite 110 includes virtualized execution segment 201, controlsegment 202, and interface segment 203, which may be coupled usingvarious communication links. Virtualized execution segment 201 isrepresentative of a virtualized execution system, which includes avirtualized user space 240 for virtual nodes 241-244, an operatingsystem or hypervisor 235, a storage system 232 to store the operatingsystem and virtual user space, and a processing system 230. Controlsegment 202 further includes flight control system 211 and propulsionnavigation 210. Interface segment 203 further includes user sensors 220and communication interface 221, wherein communication interface 221 maybe used for ground communication and inter-satellite communication. Usersensors 220 may include imaging sensors, temperature sensors, lightsensors, or some other similar sensor capable of interaction withvirtual nodes 241-244.

As described herein, organizations may generate applications that arecapable of being deployed as virtual nodes on one or more satellites ofa satellite platform. These applications may be provided from a groundcontrol system, or may be provided from another satellite viacommunication interface 221 on satellite 110. Once the applications areprovided, operating system/hypervisor 235, which is stored on storagesystem 232 and executed by processing system 230 may provide a platformfor the execution of the applications. Here, each application providedto satellite 110 is executed as a separate virtual node in virtual nodes241-244, wherein the virtual nodes may comprise full operating systemvirtual machines or containers capable of sharing resources from theunderlying operating system in storage system 232.

To manage the execution of the virtual nodes, operatingsystem/hypervisor 235 may manage a schedule that is used to allocateprocessing resources of processing system 230 to each of the nodes, usersensors 220 to each of the nodes, and other similar resources onsatellite 110. In particular, the schedule may be used to ensure thateach application is scheduled to receive processing resources fromprocessing system 230 during defined time periods, and receive access touser sensors 220 during defined time periods. In some implementations,one or more of the applications may execute during the same time periodon satellite 110. These applications may use different sensors in usersensors 220, may time share the use of sensors in user sensors 220, ormay use the same data from user sensors 220 in their operation. Toallocate the sensors operating system 235 may be responsible forproviding each operating virtual node with a communication link to therequired user sensor, and deallocating or removing the communicationlink to the required sensor based on the scheduling. For example, animaging device may be accessed by virtual node 241 during a first timeperiod, wherein virtual node 241 may access the sensor based onaddressing information provided by operating system 235. Once the timeperiod expires, operating system 235 may prevent virtual node 241 fromaccessing the sensor, in some examples, by removing the addressingaccess of the virtual node, and allocating access of the sensor to asecond virtual node.

In addition to the virtual node operations provided in virtualizedexecution segment 201, satellite 110 further includes control segment202. Control segment 202, which may be communicatively linked tovirtualized execution segment 201 and interface segment 203, isresponsible for logistical control elements of the satellite ofsatellite 110. These operations may include managing the deployment ofsolar panels on the satellite, managing the positioning of the satellitewith regards to the Earth or the sun, or any other similar operation. Inat least one example, flight control system 111 may monitor for requestsfrom operating system 235, and determine whether the satellite iscapable of accommodating the request from operating system 235. Forexample, virtual node 241 may generate a request to move a user sensor,which also requires movement using propulsion and navigation 210. Inresponse to the request, flight control system 211 may determine thatthe movement cannot be made, and may prevent the movement of thesatellite using propulsion and navigation 210. Further, in someimplementations, flight control system 211, may provide a notificationto operating system 235 and virtual node 241 indicating that themovement is not permitted.

Although illustrated as a separate system in the example of FIG. 2, itshould be understood that in some examples, flight control system may beimplemented and stored on processing system 230 and storage system 232.However, it should also be understood that flight control system may bestored on a separate storage system and use a different processingsystem than operating system 235 and its corresponding virtual nodes.

FIG. 3 illustrates an operation of deploying satellites capable ofproviding a platform for virtual nodes according to an implementation.The operations in FIG. 3 are referenced parenthetically in theparagraphs that follow with reference to systems and objects ofsatellite environment 100 of FIG. 1.

As depicted, the operation includes developing (301) an applicationcapable of being deployed as a virtual node in one or more satellites ofa satellite platform. To develop the applications, design platform 175may be provided to the developer that includes tools and APIs thatpermit the application to use and access sensors on the satellite toretrieve desired data. Once the application is developed using designplatform 175, the developer will test (302) the application using asimulation platform, represented in FIG. 1 by verification platform 176,wherein the verification platform may provide a physical or virtualsimulation platform to monitor the operations of the application.Further, verification platform 176 may provide various tests to ensurethat the application will not interfere with other cooperatingapplications, or cause any issues with the flight of the satelliteitself.

Once tested, the application may be deployed (303) to one or moresatellites in the satellite platform. In some examples, to deploy theapplication to the satellites, the application may require a schedule,wherein the schedule may be determined based on the task and budgetrequirements of the developer of the application. In at least oneimplementation, the user may provide geographic areas of interest,operation times of interest, budget constraints, or any other similarvariables, including combinations thereof, to orchestration platform177. Once the variables are provided, the user may select from a pool ofavailable satellites and operation times to implement the desired task.Once scheduled, the application may be deployed to one or moresatellites in the satellite platform via ground control system 170.After being deployed along with an updated schedule for each of thesatellites, the application may execute as a virtual node alongside oneor more applications on the same satellite.

As an optional operation, as illustrated in FIG. 3, the application mayfurther be deployed (304) from a first satellite to one or moresecondary satellites. This deployment across the satellites permitsground control system 170 to upload the application fewer times to thesatellite platform, and instead permits the applications themselves todistribute or deploy the applications to other satellite nodes in theplatform. For example, ground control system 170 may deploy anapplication to satellite 122. In turn, satellite 122 may deploy theapplication to satellites 111-112 to generate peer group 141 for theapplication. Thus, instead of relying on ground control system 170 toprovide applications to the individual satellites, the satellitesthemselves may deploy applications throughout the satellite platform.

FIG. 4 illustrates an operation of deploying virtual applications in asatellite according to an implementation. The operations in FIG. 3 arereferenced parenthetically in the paragraphs that follow with referenceto systems and objects of computing environment 100 of FIG. 1. Inparticular, the operations of FIG. 4 will be described with reference tosatellite 110 of FIGS. 1 and 2.

As illustrated in FIG. 4, the operation includes deploying (401) aplurality of applications capable of execution as individual virtualnodes on satellite 110. These virtual nodes may include full operatingsystem virtual machines in some examples, but may also comprisecontainers, such as Docker and Linux containers in some instances. Theseapplications may be provided to satellite 110 using ground controlsystem 170, and may also be provided via other satellites orbiting inthe satellite platform. In addition to the applications, the operationfurther includes deploying (402) a resource schedule for the pluralityof applications on satellite 110, wherein the resource schedule is usedto schedule user sensor availability and processing system resources toeach of the applications. This scheduling of resources may include timedivision scheduling in some examples, wherein two applications may beprevented from accessing the processing system and/or a sensor at anyone instance. For example, a first application operating as virtual node241 may execute during a first time period on processing system 230,whereas a second application operating as virtual node 242 may executeduring a second time period on processing system 231. In addition to orin place of time resource scheduling, applications may further beprovided with hardware resource scheduling, which may be used to providethe physical hardware of satellite 110 to multiple applications at anyone instance. For example, a first application operating as virtual node241 may execute using a first processing core of processing system 230,whereas a second application operating as virtual node 242 may executeusing a second processing core of processing system 230.

Although these are some examples of time division and resource divisionthat may be accomplished via the resource schedule provided to satellite110, it should be understood that other combinations of time divisionand resource division may be provided via the resource schedule.

Once the applications and the resource schedule are provided tosatellite 110, the operation further includes executing (403) theplurality of applications based on the resource schedule. In someimplementations, once the schedule is provided, the schedule may be usedby operating system 235 to determine the allocation and executionprivileges of each of the virtual nodes. Accordingly, operation system235, based on the schedule, may start and stop virtual machines, provideaddressing to sensors to each of the virtual machines, establishsecurity measures to prevent improper access of resources to the virtualmachines, among other possible scheduling operations.

Referring now to FIG. 5, FIG. 5 illustrates a satellite system 500capable of providing state information between satellites according toan implementation. Operational scenario 500 includes satellite cluster520 with satellites 510-512, and further includes ground control system530 on Earth 540.

As described herein, a satellite platform may be deployed, wherein aplurality of satellites is capable of providing a processing space forsoftware applications. In some implementations, the satellite platformcan use state information to ensure that a backup is available in caseof a failure of one of the satellites, and further can be used tocommunicate data for applications that execute across multiplesatellites. Here, each of satellite of satellites 510-512 maintain localstate information, communicate state information with at least one othersatellite, and provide state information with ground control system 530.

In some implementations, satellite 510 may be configured with a firstversion of an application while satellite 511 is configured with asecond version of the application. During the operation of thesatellites, satellite 510 may maintain state information related toexecution of the first application node and transfer the stateinformation for delivery to satellite 511. Satellite 511 may receive thestate data, and execute the second application node in accordance withthe state information. This state data may include information about theprocesses being executed for the first application node, sensor databeing retrieved for the first application node, or any other similarstate information.

As a result of this configuration, in some examples, satellite 510 maymaintain state information for the first application, such as processedand/or unprocessed imaging data, and transfer the state information tosatellite 511. Satellite 511 may then modify the state information usingthe second version of the application, wherein modifying the stateinformation may include adding additional sensor data from sensors 511,processing the sensor data from the first satellite and the secondsatellite, removing portions of the data from the first satellite, orproviding some other similar operation of the data. Once the stateinformation is modified, the state information may be communicated tosatellite 512, or may be communicated to the ground control system. Insome implementations, such as those with imaging sensors on satellites510-512, the exchange of state information from a first satellite to asecond satellite may be used by the second satellite to track at leastone ground-based object of interest, or may be used to refine analysisof the state information, based on new sensor data, to act as arecognition process for at least one ground-based object of interest.

In some examples, in place of acting as a peer to modify the stateinformation from the first application node on satellite 510, satellite511 may be configured to operate as a backup for the first applicationon satellite 510. In particular, satellite 510 may provide stateinformation to satellite 511, wherein the state information includes thecurrent state of application 510. As the state information is providedto peer satellite 511, satellite 511 may identify a fault in theoperational state of satellite 510. In response to identifying thefailure, satellite 511 will identify a new peering node that is capableof executing at least one failed virtual node from satellite 510, andestablish the new peering node based at least in part on the stateinformation that was received from satellite 510. In someimplementations, the new peering node may comprise satellite 511,however, it should be understood that the new peering node may compriseanother satellite within the satellite platform.

To further demonstrate the operations of satellite system 500, FIG. 6 isprovided. FIG. 6 illustrates a timing diagram of overcoming a failure ofa satellite in a satellite cluster according to an implementation. FIG.6 includes satellites 510-512 from satellite system 500 of FIG. 5.

As illustrated in the present example, satellites 510-512 exchange stateinformation, wherein the state information includes information aboutthe current state of the applications executing on each of the nodes.This state information may include what applications are executing(scheduling information), what tasks or processes are executing for eachof the applications, data from each of the applications, or some othersimilar state information. During the exchange of state information,satellite 511 encounters a failure, which may result from a variety offactors including, but not limited to, a hardware failure, a softwarefailure, a solar event, or some other similar failure. Once the failureoccurs, another satellite, in this example, satellite 512 identifiesthat satellite 511 is incapable of recovery from the failure, andidentifies a previous state for satellite 511 prior to the failure.After the identification of the previous state, satellite 512 thenprovides the state to satellite 511, permitting satellite 511 toimplement the previous state.

In some implementations, to exchange the state information between thesatellites, each of the satellites may be configured to provide stateinformation at defined intervals. These intervals may be defined by theapplications themselves operating on the satellites, or may be definedby the operating system or hypervisor providing the platform for theapplications. In some examples, the state exchange between satellitesmay be defined by the operating system and or the satellite platformprovider, such that the provider may select, which satellites should beused in exchanging states. In other implementations, the applicationsmay be used to define which satellites should be defined as a clusterfor exchanging state information. For example, the application mayexchange state information with other satellites that are used forexecuting versions of the application.

In at least one implementation, in identifying that satellite 511 cannotrecover from a failure, satellite 512 may be configured to receivenotifications from satellite 511 indicating whether satellite 511 iscapable of operating without recovery state information from satellite512. If satellite 511 indicates that it cannot recover, either through adirect notification or a lack of a notification, satellite 512 mayidentify the last state received and provide the state to satellite 511for implementation. This providing of the state may include the statefor all applications on satellite 511, or a portion of the state dataassociated with the applications that encountered a failure.

FIG. 7 illustrates an operation for overcoming a failure of at least oneapplication node on a satellite according to an implementation. Theoperations in FIG. 7 are referenced parenthetically in the paragraphsthat follow with reference to systems and objects of satellite system500 of FIG. 5. In particular, references will be made with a failure ofsatellite 511, however, it should be understood that similar operationsmay be provided by satellites 510 and 512 of the satellite system.

As depicted, the operations of satellite 511 include maintaining (701)local state information for virtual application nodes on satellite 511,wherein the application nodes may comprise full operating system virtualmachines or virtual containers, and wherein the state information maycomprise information about the processes executing for each of theapplications and data retrieved for the executing processes. As thestate information is collected for each of the virtual nodes, theoperation further provides for identifying (702) an interruption eventfor at least one of the application virtual nodes. This interruption maycomprise a software interruption or failure, a hardware interruption orfailure, or an interruption due to a natural even, such as a solar flareor space debris. The interruption may be identified by the operatingsystem or hypervisor for the application nodes, and may be identifieddue to a restart of the operating system or hypervisor, unusual orunpredictable activity from the application, the application reportingan issue to the operating system or hypervisor, or some otherinterruption identifiable event.

In response to identifying the interruption event for the at least oneapplication node, the operation of satellite 511 further identifies(703) a most recent state for the at least one application node, andconfigures the user space based on the most recent state for the atleast one application node (704). For example, as an application isexecuting on satellite 511, operational states may be maintained locallyon the satellite, such that the states may be used to recover from afailure of at least one application node. These states may be stored onseparate storage media of the satellite, or the same storage media asthe primary applications, and may be updated at defined intervals. Inresponse to identifying a failure for an application node executing onthe satellite, a recent state may be identified that is stored on thesatellite, and the application restored to the previous state. In someexamples, this state update may include resuming processes that wereexecuting prior to the failure. In other implementations, in addition toor in place of resuming processes for the application node, data may berefreshed on satellite 511 to place the at least one application in theprevious state prior to the failure.

FIG. 8 illustrates an operational scenario 800 of providing stateinformation between satellites according to an implementation.Operational scenario 800 includes systems and elements from satellitesystem 500 of FIG. 5. In particular, operational scenario 800 includessatellites 510-512, ground control system 530, and Earth 540 fromsatellite system 500 of FIG. 5.

In operation, satellites 510-512 may be configured with applicationnodes that can handoff operation data between satellites. This handoffpermits the applications to continue operations on geographic featuresalthough a single satellite may be incapable with its defined orbit. Forexample, an application may be developed to take images and process theimages over a particular geographic region. As a first satellite takesand processes the images, the satellite's orbit may move away from thegeographic area of interest. As a result, the application on the firstsatellite may provide state information, or imaging data in the presentexample, to a second satellite, permitting the second satellite tocontinue the operations with respect to the geographic area of interest.

Here, as depicted in operational scenario 800, satellite 510, a step 1identifies first sensor data, and transfers, at step 2, the sensor datato satellite 511. In some examples, the sensor data that is transferredfrom satellite 510 to satellite 511 may comprise raw sensor data,wherein the raw sensor data may comprise raw imaging files, heatmapping, light measurements, or some other sensor data from the sensorson satellite 510. Once received from satellite 510, satellite 511 mayidentify, at step 3 second sensor data, and transfer, at step 4, thesensor data and the second sensor data to satellite 512.

In some implementations, satellite 511 may be configured to performoperations on the combined data from satellite 510 as well as the localsensor data identified by satellite 511 to generate modified state data.For example, if the application were an imaging application, satellite511 may use images obtained from satellite 510 and local imagesidentified using one or more imaging sensors on satellite 511 indetermining characteristics of the images. These characteristics mayinclude the movement of objects in the images, physical changes in theobjects of the images, or some other determination from the images. Insome examples, the processed data may also be forwarded to satellite 512with the raw data identified by satellites 510-511.

Once the data is received from satellite 511, satellite 512 may identifythird sensor data, at step 5, and identify, at step 6, attributes of thereceived and locally identified state data. Referring back to theimaging data example, satellite 512 may use the imaging data obtainedfrom sensors on satellites 510-511, as well as local imaging dataobtained from sensors 512 to identify attributes within the images. Thismay permit satellite 512 to identify characteristics or attributeswithin a particular geographic area that may not have been capable ofidentification with the information solely from the sensors of satellite512.

In some examples, the information that is transferred between thesatellites may include identifiable characteristics from the previoussatellite. These characteristics may include information that wasobtained via the processing of the sensor data at that particularsatellite. For instance, satellite 510 may identify an object ofinterest within a geographic region, and communicate characteristics ofthe object to satellite 511. These characteristics may include the shapeof the object, the location of the object, or any other similarcharacteristics of the object. Based on the information from satellite510, and in some examples any raw data provided from satellite 510,satellite 511 may identify additional characteristics of the object ofinterest. These characteristics may include the movement of the object,any shape or color changes of the object, or any other similarcharacteristics. Further, in addition to or in place of satellite 511identifying characteristics for the object, satellite 511 may forwardraw data and identified characteristics to satellite 512. This permitssatellite 512 to identify attributes within the raw data based at leastin part on attributes identified by satellites 510-511.

As further illustrated in operational scenario 800, as attributes orcharacteristics are identified by the satellites, the data may bereported to ground control system 530 as state information. This stateinformation may include only relevant data related to the identifiedattributes of the sensor data, but may also include at least a portionof the raw sensor data in some examples. Further, while only illustratedas satellite 512 reporting state data to ground control system 530, itshould be understood that state data may be provided from any ofsatellites 510-511 to ground control system 530.

FIG. 9 illustrates an operational scenario 900 of generating a new peerin response to a satellite failure according to an implementation.Operational scenario 900 includes systems and elements from satellitesystem 500 of FIG. 5. In particular, operational scenario 900 includessatellites 510-512 and further includes new satellite 513.

As described herein, satellites within a satellite platform may begrouped into peer clusters, wherein the peer clusters exchange stateinformation for virtual nodes executing on each of the satellites. Thisstate information may include images for the applications executing onthe nodes, processes executing for the individual applications, sensordata for the applications, or any other similar information. Asillustrated in operational scenario 500, satellites 510-512 mayexchange, at step 1, state information for the applications executingthereon. While exchanging the state information, at least one ofsatellite 511 or satellite 512 may identify a failure with satellite510. This failure may be a result of a hardware failure, a softwarefailure, or some other similar type of failure, wherein at least one ofthe virtual nodes may be incapable of operation. In response toidentifying the failure, which may be detected when satellite 510reports a failure or when state notifications are not received fromsatellite 510, a new satellite 513 may be added to the peer cluster, atstep 3, for the exchange of state information.

In some implementations, in identifying the new peer, the new peer maybe used to store state information from satellites 511-512 and may notbe used to execute applications for failed satellite 510. In otherimplementations, in identifying the new peer, satellite 513 may beconfigured to execute one or more applications of satellite 510 inaccordance with the state information provided by satellites 511 and/or512 to overcome the failure of satellite 510. Once joined, satellite 513may further be configured to communicate future state information withsatellites 511 and 512.

FIG. 10 illustrates a timing diagram 1000 of overcoming failure of asatellite in a satellite system according to an implementation. FIG. 10includes satellites 510-512 from satellite system 500 of FIG. 5.

As depicted, satellites 510-512, which act as a peer satellite group,exchange state information that includes operational state informationfor at least one application executing thereon, and sensor datainformation gathered for processing by the at least one application.During the exchange of state information, satellite 511 may encounter ahardware or software failure that prevents execution of at least oneapplication on the satellite. After the failure, satellites 510-511identify that satellite 511 is incapable of recovery from the failureand initiates implementation of failed application nodes.

In at least one implementation, to identify the failure in satellite511, satellites 510 and 512 may exchange health check communicationswith satellite 511. If satellite 511 indicates in one of thecommunications that a failure has occurred, or fails to communicate ahealth check communication within a defined time period, satellites511-512 may identify that a failure has occurred. Once the failure isidentified, in implementing the failed nodes, the implementation mayoccur immediately after identifying the failure, or may occur after atime period has elapsed in relation to the failure. For example,satellite 512 may identify the failure of satellite 511, and holdimplementation of the failed nodes until it is determined that satellite511 is unavailable after a defined time period. Once the time period haselapsed, satellite 512 may implement one or more of the failedapplications as virtual nodes.

Although illustrated in the example of FIG. 10 with two satellitesimplementing the failed nodes from satellite 511, it should beunderstood that any number of satellites may be used in implementing thefailed nodes. For example, satellite 511 may provide state informationto satellite 512, permitting satellite 512 to implement the failedapplication nodes from satellite 511.

Referring now to FIG. 11, FIG. 11 illustrates a satellite operationaccording to an implementation. FIG. 11 includes satellite 510 fromsatellite system 500 of FIG. 5, although it should be understood thatsimilar operations may occur with any satellites of the satelliteplatform.

As depicted, satellite 510 is configured to receive application andstate information from a ground control system. This application andstate information may include updates to the operating system orhypervisor of the virtual machine, user software payloads (applicationsand updates), and state information, which may include tasks for theapplication, schedules for the applications, or any other similarinformation. In addition to the communications with the ground,satellite 510 is further configured to execute applications that arestored in the user space of the satellite, and provide sensor data toeach of the applications. These applications execute according to aschedule, which may be provided from the ground control system andimplemented by the operating system or hypervisor for the virtual nodes,wherein the schedule allocates resources to each of the applications.These resources may include processing resources as well as sensorresources on the satellite. Further, during the execution of the virtualnodes, satellite 510 is configured to maintain state information foreach of the applications. This state information may include the stateof processes executing for each application, data gathered for eachapplication, or other similar state information, and may be gathered atdefined intervals. In some implementations, the state information may bestored locally on the satellite to recover from hardware or softwarefailures with one or more applications. In some implementations, thestate information may be communicated to one or more other peersatellites and/or the ground control system, wherein the stateinformation may be used in recovery during a failure event. This stateinformation may be used to recover satellite 510, or may be used toimplement the applications as virtual nodes on the other peersatellites.

As described above, to provide the execution of the applications, anoperating system or hypervisor may be used to swap user tasks and managethe allocation of resources to each of the virtual application nodesexecuting on satellite 510. This scheduling may include time divisionallocation of resources, such as providing a first application withaccess to a user sensor for a first time period and providing a secondapplication with access to the same user sensor for a second timeperiod, and may further include physical sharing of resources, such asproviding one or more cores to a first virtual node and providing one ormore secondary cores to a second virtual node. Although these are just afew examples of allocating resources on a satellite, it should beunderstood that any combination of time division and physical resourcedivision may be employed based on the schedule provided to thesatellite.

In addition to providing a platform for the applications on satellite510, one or more processes may be dedicated to health monitoring.Similar to the operations described above, satellites may be configuredas peers or as a cluster, permitting satellites to monitor theoperations on other satellites. This permits satellite 510 to providehealth check communications to other satellites, as well as receivenotifications or alerts when a failure or issue is detected. In someexamples, to identify a failure in a second satellite, satellite 510 maydirectly receive a notification indicating the failure. In otherexamples, satellite 510 may fail to receive a “heartbeat” or statusnotification within a defined time period, and based on the lack ofreceipt may determine that a failure has occurred in another satellite.

Once a failure is identified for a second satellite, satellite 510 mayinitiate one or more new virtual nodes to support applications from thesecond satellite, may provide state information to the second satelliteto assist in recovery of the second satellite, may identify a thirdsatellite to be added to the peer group to replace the second satellite,or may provide some combination of the operations.

FIG. 12 illustrates a deployment user interface 1200 according to animplementation. Deployment user interface 1200 includes satellites1210-1213 and 1220-1223, which represent satellite clusters forapplication deployment. Deployment interface 1200 is representative ofan interface that could be used in the simulation of deploying anapplication, or could be used to provide state information about adeployed application.

First, as a simulation interface, development user interface 1200 may beused for testing the functionality of an application, and may further beused to determine if the application passes any verification tests. Adeveloper may deploy the application to one or more of the simulatedsatellites 1210-1213 and 1220-1223 and monitor the operations of theapplication over a period of time. If the developer determines that theapplication is operating as desired, the application may be approved fordeployment, and may be deployed to one or more satellites in thephysical satellite platform. If, however, the developer determines thatmodifications are required, the developer may return to the developmenttool to make changes to the application code. In some examples, thedevelopment user interface may be used to provide artificial sensor datato the application to ensure that the application processes arefunctioning as desired. This artificial sensor data may include imagingdata, light measurements, heat measurements, or some other data based onthe sensors required by the application.

Second, a similar interface may be provided to an administrator ordeveloper of an application to monitor the deployment of the applicationin the physical platform. In particular, the satellites in the satelliteplatform may be configured to provide state information to a groundcontrol system for the platform. This information may include thecurrent operational state of the application (processes running, memorystate, storage state, and the like), and may further include informationabout the sensor data that is being obtained (both processed andunprocessed). Based on the state information, development user interface1200 may display the state of the application as it is deployed in theframework. For example, if the application were deployed in a satellitecluster comprised of satellites 1210-1213, development user interface1200 may provide state information for the application on each of thesatellites. However, other applications that are co-executing on thesame satellite or other satellites of the platform may not be providedto the administrator or developer.

Although illustrated as a user interface in the example of FIG. 12, itshould be understood that in some examples the testing and monitoring ofthe applications may be accomplished via a physical representation ofthe deployed satellites. This physical representation may include one ormore satellite models that can be used to test an application before itis deployed or represent the current state of an application after it isdeployed.

FIG. 13 illustrates a satellite computing system 1300 to provide avirtualized satellite application platform according to animplementation. Computing system 1300 is representative of any computingsystem or systems with which the various operational architectures,processes, scenarios, and sequences disclosed herein for a satellite maybe implemented. Computing system 1300 is an example of a satellite fromFIG. 1 and FIG. 5, although other examples may exist. Computing system1300 comprises communication interface 1301, sensors 1302, andprocessing system 1303. Processing system 1303 is linked tocommunication interface 1301 and sensors 1302. Sensors 1302 may compriseimaging sensors, heat sensors, light sensors, or some other similar typeof sensor. Processing system 1303 includes processing circuitry 1305 andmemory device 1306 that stores operating software 1307. Computing system1300 may include other well-known components such as a battery, solarpanels, and enclosure that are not shown for clarity.

Communication interface 1301 comprises components that communicate overcommunication links, such as network cards, ports, radio frequency (RF),processing circuitry and software, or some other communication devices.Communication interface 1301 may be configured to communicate overwireless links. Communication interface 1301 may be configured to useTime Division Multiplex (TDM), Internet Protocol (IP), wirelessprotocols, communication signaling, or some other communicationformat—including combinations thereof. In some implementations,communication interface 1301 may communicate with one or more othersatellites in a satellite platform and communicate with a ground controlsystem.

Processing circuitry 1305 comprises microprocessor and other circuitrythat retrieves and executes operating software 1307 from memory device1306. Memory device 1306 may include volatile and nonvolatile, removableand non-removable media implemented in any method or technology forstorage of information, such as computer readable instructions, datastructures, program modules, or other data. Memory device 1306 may beimplemented as a single storage device, but may also be implementedacross multiple storage devices or sub-systems. Memory device 1306 maycomprise additional elements, such as a controller to read operatingsoftware 1307. Examples of storage media include random access memory,read only memory, magnetic disks, optical disks, and flash memory, aswell as any combination or variation thereof, or any other type ofstorage media. In some implementations, the storage media may be anon-transitory storage media. In some instances, at least a portion ofthe storage media may be transitory. It should be understood that in nocase is the storage media a propagated signal.

Processing circuitry 1305 is typically mounted on a circuit board thatmay also hold memory device 1306 and portions of communication interface1301 and sensors 1302. Operating software 1307 comprises computerprograms, firmware, or some other form of machine-readable programinstructions. Operating software 1307 includes control module 1308,operating system module 1309, and nodes 1310, although any number ofsoftware modules may provide the same operation. Operating software 1307may further include utilities, drivers, network interfaces,applications, or some other type of software. When executed byprocessing circuitry 1305, operating software 1307 directs processingsystem 1303 to operate computing system 1300 as described herein.

In at least one implementation, nodes 1310 may be deployed to satellitecomputing system 1300 that represent full operating system virtualmachines or containers, wherein each node is configured to provide aparticular application. To run the nodes, operating system module 1309,which may comprise an operating system and/or a hypervisor, may beexecuted by processing system 1303, wherein operating system module 1309provides a platform for nodes 1310. In some implementations, inproviding the platform, operating system module 1309 may be configuredwith a resource schedule, which allocates processing and sensors 1302 toeach node in nodes 1310. This allocation of resources, may comprise timedivision allocation of resources, such as providing a first applicationwith access to a user sensor for a first time period and providing asecond application with access to the same user sensor for a second timeperiod, and may further include physical sharing of resources, such asproviding one or more cores to a first virtual node and providing one ormore secondary cores to a second virtual node.

In addition to executing the applications for each of nodes 1310,operating system module 1309 may further provide a platform for statedetermination and distribution. This state determination may permitprocessing system 1303 to identify states for each of the applicationsand share the states with other satellites and the ground controlsystem. The states may include the operational state of processes withineach application node, and/or data states for each of the applicationnodes. The states may be used in recovery of the various applicationsexecuting on satellite computing system 1300, and may further be used inproviding enhanced data operations for the applications. For example, anapplication executing as a node on satellite computing system 1300 maycommunicate data to a second satellite node. This satellite node mayidentify second data, using sensors on the second satellite, and combinethe data from the first satellite with the second data to provide aparticular operation. This operation may include imaging analysis insome examples, where the application can determine whether an object ismoving, the type of object, the rate of movement in the object, or someother similar determination based on the combined data.

As an illustrative example, satellite computing system 1300 may use oneor more imaging sensors or an imaging system in sensors 1302 toestablish state information related to imaging data gathered by theimaging sensors. Once identified, the state information may becommunicated to a second satellite device, wherein the second satellitedevice may employ second imaging sensors to modify the state informationwith at least imaging data captured by the second imaging sensors. Thismodification may include positional tracking of at least oneground-based object of interest, or may include a refining analysis ofthe state information based on the imaging data captured by the secondimaging sensors to act as a recognition process for at least oneground-based object of interest.

In some examples, in addition to or in place of exchanging the stateinformation to provide additional analysis on the sensor data, the stateinformation may also be used to provide a backup of satellite computingsystem 1300. In particular, the state information may be shared with asecond satellite device permitting the second satellite device toimplement one or more virtual nodes from satellite computing system 1300when a failure is detected. This implementation or establishment of theone or more virtual nodes may occur directly at the satellite receivingthe state information from satellite computing system 1300, or may occuron a third satellite configurable by the satellite receiving the stateinformation from satellite computing system 1300.

Although illustrated in the previous example as providing information toother satellites, it should be understood that satellite computingsystem 1300 may also be configured to receive state information fromother satellites and provide similar operations in accordance with thereceived state information. These operations may include modifying thestate information based on sensors for satellite computing system 1300,or providing backup peering operations based on the state informationprovided from the secondary satellites.

As also illustrated in FIG. 13, satellite computing system 1300 furtherincludes control module 1308, which is used as a flight control systemfor the satellite. In particular, control module 1308, which may operateusing distinct processing circuitry on satellite computing system 1300,may be responsible for power management and flight control of thesatellite. In some examples, control module 1308 may receive requestsfrom nodes 1310 and operating system 1308 to provide data to theapplications on nodes 1310. If a request can be accommodated, withoutcomprising the flight of the satellite, control module 1308 may providethe requested data to operating system module 1309 or the correspondingnode. In contrast, if it is determined that the information cannot beprovided or a flight operation cannot be accommodated, then controlmodule 1308 may fail to provide the data or the flight operation.

FIG. 14 illustrates a development computing system 1400 to generatevirtual satellite applications according to an implementation. Computingsystem 1400 is representative of any computing system or systems withwhich the various operational architectures, processes, scenarios, andsequences disclosed herein for a ground control system can beimplemented. Computing system 1400 is an example of a ground controlsystem from FIG. 1 and FIG. 5, although other examples may exist.Computing system 1400 comprises communication interface 1401, userinterface 1402, and processing system 1403. Processing system 1403 islinked to communication interface 1401 and user interface 1402.Processing system 1403 includes processing circuitry 1405 and memorydevice 1406 that stores operating software 1407. Computing system 1400may include other well-known components such as a battery, power supply,and enclosure that are not shown for clarity. Computing system 1400 mayrepresent one or more server computing systems, desktop computingsystems, laptop computing systems, tablets, or some other computingsystem, including combinations thereof.

Communication interface 1401 comprises components that communicate overcommunication links, such as network cards, ports, radio frequency (RF),processing circuitry and software, or some other communication devices.Communication interface 1401 may be configured to communicate overmetallic, wireless, or optical links. Communication interface 1401 maybe configured to use Time Division Multiplex (TDM), Internet Protocol(IP), Ethernet, optical networking, wireless protocols, communicationsignaling, or some other communication format—including combinationsthereof. In some implementations, communication interface 1401 may beconfigured to communicate with satellites of a satellite platform toprovide applications, updates, and other configuration information, andmay further be configured to receive from the satellites stateinformation related to the state of processes for each of theapplications and data for the each of the applications.

User interface 1402 comprises components that interact with a user toreceive user inputs and to present media and/or information. Userinterface 1402 may include a speaker, microphone, buttons, lights,display screen, touch screen, touch pad, scroll wheel, communicationport, or some other user input/output apparatus—including combinationsthereof. User interface 1402 may be omitted in some examples. In someimplementations, user interface 1402 may be used to receive developerinput to generate a desired application, and test the application withina virtual satellite environment. A display screen may also be used todisplay state information related to the applications deployed in thephysical satellite platform.

Processing circuitry 1405 comprises microprocessor and other circuitrythat retrieves and executes operating software 1407 from memory device1406. Memory device 1406 may include volatile and nonvolatile, removableand non-removable media implemented in any method or technology forstorage of information, such as computer readable instructions, datastructures, program modules, or other data. Memory device 1406 may beimplemented as a single storage device, but may also be implementedacross multiple storage devices or sub-systems. Memory device 1406 maycomprise additional elements, such as a controller to read operatingsoftware 1407. Examples of storage media include random access memory,read only memory, magnetic disks, optical disks, and flash memory, aswell as any combination or variation thereof, or any other type ofstorage media. In some implementations, the storage media may be anon-transitory storage media. In some instances, at least a portion ofthe storage media may be transitory. It should be understood that in nocase is the storage media a propagated signal.

Processing circuitry 1405 is typically mounted on a circuit board thatmay also hold memory device 1406 and portions of communication interface1401 and user interface 1402. Operating software 1407 comprises computerprograms, firmware, or some other form of machine-readable programinstructions. Operating software 1407 includes design module 1408,verify module 1409, and deploy module 1410, although any number ofsoftware modules within the application may provide the same operation.Operating software 1407 may further include an operating system,utilities, drivers, network interfaces, applications, or some other typeof software. When executed by processing circuitry 1405, operatingsoftware 1407 directs processing system 1403 to operate computing system1400 as described herein.

In at least one implementation, design module 1408 directs processingsystem 1403 to provide a platform to a developer that permits thedeveloper to generate a new application capable of implementation as avirtual node on a satellite. In some examples, design module 1408 mayprovide tools and APIs that permit the node to request and receive datafrom physical sensors, such as imaging, light sensing, temperaturesensing, and other similar sensors, and process at least a portion ofthe data. Design module 1408 may also be used to design an application,wherein different versions of the application, located on differentsatellites may exchange state information to enhance the ability toidentify characteristics within the sensor data.

Once the application is generated using design module 140, verify module1409 may be used that provides a virtual or physical testing interfacefor the generated application. This testing interface may includerepresentations of one or more physical satellites, wherein theapplication can be deployed to the testing satellites to verify theoperation of the application. This testing may include providing testdata to the applications, testing the applications against failures,amongst other possible testing operations. If the application executesas desired, then the application may be approved for deployment,however, if the application fails to execute as desired, the developermay return to the design module to make modifications to theapplication.

After testing the application, deploy module 1410 directs processingsystem 1403 to deploy the application to one or more satellites in theorbiting satellite platform. This deployment may include deploying theapplication on an uplink directly to each of the required satellites, ormay include deploying the application to one or more first satellitesthat distribute the application to other satellites of the platform.

Here, when deploying the application, deploy module 1410 directsprocessing system 1403 to determine a resource schedule for theapplication in relation to other applications in the satellite platform.In at least one implementation, the user may select properties, such ascost, time required for operation of the application, sensors requiredfor the application, and the like. In response to providing theproperties, time slots and satellites may be made available to thedeveloper indicating available satellites and times that meet therequired properties. From the available satellites and times, thedeveloper may select a schedule for the application, and the applicationmay be deployed to the required satellites for the application.

The included descriptions and figures depict specific implementations toteach those skilled in the art how to make and use the best option. Forthe purpose of teaching inventive principles, some conventional aspectshave been simplified or omitted. Those skilled in the art willappreciate variations from these implementations that fall within thescope of the disclosure. Those skilled in the art will also appreciatethat the features described above can be combined in various ways toform multiple implementations. As a result, the invention is not limitedto the specific implementations described above, but only by the claimsand their equivalents.

What is claimed is:
 1. A satellite system, comprising: a communicationinterface configured to receive software payloads for execution by thesatellite system; a satellite control system configured to operatelogistical control elements of the satellite system; and a virtualizedexecution system configured to execute ones of the software payloadsdeployed on the satellite system as associated virtual nodes that shareresources of the satellite system, maintain state information related toexecution of ones of the virtual nodes, and transfer the stateinformation over the communication interface for delivery to at leastone peer satellite system configured as a backup to the satellitesystem.
 2. The satellite system of claim 1, comprising: the virtualizedexecution system configured to execute the ones of the software payloadsas the associated virtual nodes on the satellite system according to atleast a resource schedule that indicates a timewise allocation of theassociated virtual nodes to the resources of the satellite system. 3.The satellite system of claim 2, comprising: the communication interfaceconfigured to receive the resource schedule and the software payloadsover at least one of a ground communication portion and aninter-satellite communication portion of the communication interface,wherein the ground communication portion communicates with aground-based station to receive first ones of the software payloads, andwherein the inter-satellite communication portion communicates with atleast one other satellite system to receive second ones of the softwarepayloads.
 4. The satellite system of claim 2, further comprising: one ormore sensor systems communicatively coupled with the virtualizedexecution system over associated communication links; the virtualizedexecution system configured to provide access for ones of the virtualnodes to the one or more sensor systems as the resources of thesatellite system.
 5. The satellite system of claim 1, comprising: thesatellite control system configured to operate the logistical controlelements of the satellite system independent of a state of thevirtualized execution system, wherein the logistical control elementscomprise one or more of satellite position control elements, satelliteinertial control elements, satellite orbital control elements, satellitepower control elements, and satellite thermal control elements.
 6. Thesatellite system of claim 1, comprising: the virtualized executionsystem comprising a hypervisor system configured to isolate executionand memory resources of the virtualized execution system among the onesof the software payloads when executing the associated virtual nodes;and the virtualized execution system comprising a storage systemconfigured to store at least the ones of the software payloads in aninactive state when not being executed by the virtualized executionsystem.
 7. The satellite system of claim 1, comprising: thecommunication interface configured to transfer the state informationover at least an inter-satellite communication portion for delivery toat least the peer satellite system.
 8. The satellite system of claim 1,further comprising: one or more sensor systems communicatively coupledto the virtualized execution system, wherein the state informationcomprises data related to monitored sensor activity of the one or moresensor systems.
 9. The satellite system of claim 1, comprising: thevirtualized execution system configured to receive peer stateinformation related to execution of one or more virtual nodes on afurther peer satellite system; the virtualized execution systemconfigured to establish execution of at least one virtual node on thesatellite system in response to receiving the peer state information,the at least one virtual node continuing at least one activity performedby the further peer satellite system and indicated in the peer stateinformation.
 10. A method of operating a satellite system, the methodcomprising: in a communication interface, receiving software payloadsfor execution by the satellite system; in a satellite control system,operating logistical control elements of the satellite system; and in avirtualized execution system, executing ones of the software payloadsdeployed on the satellite system as associated virtual nodes that shareresources of the satellite system, maintaining state information relatedto execution of ones of the virtual nodes, and transferring the stateinformation over the communication interface for delivery to at leastone peer satellite system configured as a backup to the satellitesystem.
 11. The method of claim 10, further comprising: in thevirtualized execution system, executing the ones of the of softwarepayloads as the associated virtual nodes on the satellite systemaccording to at least a resource schedule that indicates timewiseallocations of the associated virtual nodes to the resources of thesatellite system.
 12. The method of claim 11, further comprising: in thecommunication interface, receiving the resource schedule over at leastone of a ground communication portion and an inter-satellitecommunication portion, wherein the ground communication portioncommunicates with a ground-based station to receive first ones of thesoftware payloads, and wherein the inter-satellite communication portioncommunicates with at least one other satellite system to receive secondones of the software payloads.
 13. The method of claim 11, furthercomprising: in the virtualized execution system, providing access forones of the virtual nodes to one or more sensor systems as the resourcesof the satellite system according to at least the resource schedule,wherein the one or more sensor systems are communicatively coupled withthe virtualized execution system over associated communication links.14. The method of claim 10, further comprising: in the satellite controlsystem, operating the logistical control elements of the satellitesystem independent of a state of the virtualized execution system,wherein the logistical control elements comprise one or more ofsatellite position control elements, satellite inertial controlelements, satellite orbital control elements, satellite power controlelements, and satellite thermal control elements.
 15. The method ofclaim 10, wherein the state information comprises data related tomonitored sensor activity of one or more sensor systems communicativelycoupled to the virtualized execution system.
 16. The method of claim 10,further comprising: in the communication interface, transferring thestate information over at least an inter-satellite communication portionfor delivery to the peer satellite system.
 17. The method of claim 10,further comprising: in the virtualized execution system, receiving peerstate information related to execution of one or more virtual nodes on afurther peer satellite system; in the virtualized execution system,establishing execution of at least one virtual node on the satellitesystem in response to receiving the peer state information, wherein theat least one virtual node continues at least one activity performed bythe further peer satellite system indicated in the peer stateinformation.
 18. A satellite software execution platform for a satellitesystem, comprising: one or more computer readable storage media; aprocessing system operatively coupled with the one or morenon-transitory computer readable storage media; and an execution servicecomprising program instructions stored on the one or more non-transitorycomputer readable storage media that, when read and executed by theprocessing system, direct the processing system to at least: storesoftware payloads for execution that are received over a communicationinterface comprising at least an inter-satellite communication portion;execute ones of the software payloads deployed on the satellite systemas associated virtual nodes, wherein the associated virtual nodes shareresources of the satellite system.
 19. The satellite software executionplatform of claim 18, comprising further program instructions, whenexecuted by the processing system, direct the processing system to atleast: provide access for ones of the virtual nodes to one or moresensor systems of the satellite system as the resources according to atleast a resource schedule that indicates timewise allocation of theassociated virtual nodes, wherein the one or more sensor systems arecommunicatively coupled with the execution service over associatedcommunication links.
 20. A satellite, comprising: a communicationinterface configured to receive software payloads for execution by thesatellite; a satellite control system configured to operate logisticalcontrol elements of the satellite independent of a state of avirtualized execution system, wherein the logistical control elementscomprise one or more of satellite position control elements, satelliteinertial control elements, satellite orbital control elements, satellitepower control elements, and satellite thermal control elements; and thevirtualized execution system configured to execute ones of the softwarepayloads deployed on the satellite as associated virtual nodes thatshare resources of the satellite.
 21. A method of operating a satellite,the method comprising: in a communication interface, receiving softwarepayloads for execution by the satellite; in a satellite control system,operating logistical control elements of the satellite independent of astate of a virtualized execution system, wherein the logistical controlelements comprise one or more of satellite position control elements,satellite inertial control elements, satellite orbital control elements,satellite power control elements, and satellite thermal controlelements; and in the virtualized execution system, executing ones of thesoftware payloads deployed on the satellite as associated virtual nodesthat share resources of the satellite.